AI supply chain attacks on JavaScript packages stopped being theoretical on February 28, 2026. That day, a commit co-authored by Anthropic’s Claude Opus added the malicious package @solana-launchpad/sdk to an open-source autonomous crypto trading project, planting a credential-stealing payload through a transitive dependency, per the Cloud Security Alliance research note. Nobody hacked the model. They aimed it.
The attack class underneath this is called slopsquatting: language models routinely fabricate package names.
And attackers register those fake names on npm or PyPI before anyone legitimate can. Researchers ran 16 code-generating models across 2.23 million Python and JavaScript samples and found 440,445 of them, 19.7%, contained at least one hallucinated package name, totaling 205,474 unique fabricated names (CSA). If your AI coding tool invents an import and you install it unchecked, you are the delivery mechanism. That sentence is the entire threat model.
Slopsquatting Replaces the Human Typo With a Confident Model
Old-school typosquatting waited for a developer to mistype a popular name. Slopsquatting replaces the human typo with an AI hallucination: the model confidently recommends a package that never existed. And an attacker pre-registers that name on npm, PyPI, or another public registry before a legitimate package can claim it (CSA). The clearest documented case is `unused-imports`, a name models hallucinate when the real package is `eslint-plugin-unused-imports`.
One plausible-looking import line, and the install does the rest.
Not every model is equally sloppy, and the gap matters for your budget. A study cited by Check Point found open-source models hallucinated packages at an average rate of 21.7%, against 5.2% for commercial models. The cheap, self-hosted models teams route bulk code generation through are the worst offenders. The discount tier is the attack surface.
It gets stranger across registries.
Researchers found 8.7% of hallucinated Python package names actually exist in the npm registry. And Python-specific code-generating models frequently hallucinate JavaScript packages (CSA). The models are not even staying confused inside one registry. My rule as an operator: every new import an AI tool adds to a client repo is hostile until I confirm the package exists, has real history. And is what the model claimed it wanted.
Claude Opus Co-Authored Malware, and PromptMink Proved It Scales
The February 28, 2026 incident is the one that should reorganize your review process. A commit co-authored by Anthropic’s Claude Opus added @solana-launchpad/sdk to an open-source autonomous crypto trading project. And the credential-stealing payload arrived through a transitive dependency (CSA). The scary part is not the payload. It is that the code path ran through a model developers explicitly trust to write their code.
That incident sits inside a bigger operation. The North Korean threat actor Famous Chollima, also tracked as Shifty Corsair, ran an AI-assisted npm supply chain campaign codenamed PromptMink by ReversingLabs. It ran for at least seven months beginning September 2025, publishing more than 60 unique malicious packages across more than 300 versions, supported by more than 20 command-and-control domains and IP addresses (CSA). Seven months of sustained, believable malicious npm packages is an industrial operation. AI collapsed the cost of producing them, and a state-backed crew noticed before most security teams did.
Mini Shai-Hulud Forged the Badge You Were Told to Check
On May 11, 2026, threat actors tracked as TeamPCP deployed a worm across npm and PyPI.
Two tallies of the damage disagree: one count put it at 404 malicious package versions across 172 npm packages and 2 PyPI packages in under six hours, while a separate report landed on 169 npm packages, 2 PyPI packages.
And 373 malicious package-version entries (CSA).
Argue about the counts if you want. The victim list ends the argument: the complete TanStack router family (42 packages), UiPath’s automation tooling suite (65 packages), the OpenSearch JavaScript client, plus Mistral AI’s official Python SDK (mistralai==2.4.6) and Guardrails AI (guardrails-ai==0.10.1), a campaign nicknamed Mini Shai-Hulud by researchers at Orca Security and Aikido Security. Those packages carried more than 518 million cumulative downloads.
The part that breaks the standard playbook: the malicious packages carried valid SLSA Build Level 3 provenance attestations.
The attackers obtained them by hijacking a legitimate GitHub Actions release pipeline, exploiting the pull_request_target trigger with Actions cache poisoning and runtime extraction of an OIDC token from the runner process, not by exfiltrating credentials externally (CSA).
Provenance did exactly what it promises. It attested to a build that really happened, in a pipeline the attacker now controlled. If your dependency policy stops at “we verify attestations,” this campaign was built specifically to pass your check.
What Small Teams Should Actually Do This Week
I run a one-person AI automation agency, which means I sit exactly where this attack aims: agents write most of the code. And I am the only reviewer left.
Speed is the product I sell, so the fixes have to be cheap. These are mine.
– Diff dependency lines separately from logic. When you review an AI-authored commit, read the package.json and lockfile changes first, on their own. The malicious part of the February 28 commit arrived through a transitive dependency, which means the dependency block was the whole attack.
– Verify every new package name before install. Confirm it exists, has real publish history, and matches what the model claimed it was importing. Slopsquatting only works on names nobody checks.
– Gate agent installs. Autonomous coding pipelines need a human approval step before they resolve and install new dependencies. That checkpoint is the one thing agentic workflows keep deleting.
– Treat provenance as necessary, not sufficient. Mini Shai-Hulud shipped valid SLSA Build Level 3 attestations. Review the release pipeline config, not just the badge it produces.
The Compounding Problem Is the Point
The uncomfortable summary: AI widens the attack surface and removes the reviewer in the same workflow change.
Slopsquatting handed attackers 205,474 pre-aimed package names. And agentic installs hand those names a delivery path with no human in the loop. You cannot patch a model’s confidence. You can refuse to let it run installs unsupervised. And you can read the dependency block of every commit it authors.
That is minutes per day, set against a worm that hit packages carrying more than 518 million downloads.
Run your lockfile audit before your next agent session runs it for you. And if you want a dependency gate built into your AI coding pipeline, that is exactly the kind of automation work I ship. Get in touch.
